Method and System for Evaluating Events

Abstract

In one embodiment, a method includes determining a plurality of event types where each event type being stored in association with event metadata. One or more events are received and an event type in the plurality of event types for each received event is determined. The method determines event metadata for each determined event type and event data from the event based on the event metadata. One or more control data objects are determined stored in association with the determined event type; one or more rules stored in associated with each of the control data objects is determined where the rule comprises one or more criteria being evaluated against one of the data values of said event; and evaluating the event data with the criterion to determine if each of the events is non-compliant or compliant with a low-level system requirement of said rule.

1 . A computer-implemented method comprising:
 storing a plurality of event types, each event type being stored in association with event metadata, the metadata specifying one or more fields of the event type;   receiving one or more events via a network interface;   for each of said events:
 determining an event type in the plurality of event types for said event; 
 determining the event metadata for the determined event type; 
 determining one or more control data objects stored in association with the determined event type, each of the one or more control data objects representing a high-level system requirement; 
 determining event data from said event by reading data values stored in the fields of said event specified by the metadata; 
 for each of the determined control data objects, determining one or more rules stored in association with the control data object, each rule having the function to evaluate compliance of an event with a low-level system requirement being particular to said rule, each rule comprising a first part and a second part, each first part comprising one or more criteria being evaluated against one of the data values of said event; and 
 executing each of the determined rules, thereby evaluating each of the one or more criteria of said rule against one of the data values of said event to determine if the event is non-compliant or compliant with the low-level system requirement of said rule, wherein in case the event is compliant with the low-level system requirement of said rule, the event is also compliant with the high-level system requirement of the control data object for which said rule was determined, and wherein in case the event is non-compliant with the low-level system requirement of said rule, the event is also non-compliant with the high-level system requirement of the control data object for which said rule was determined; 
 in case it was determined that the event is non-compliant with the low-level system requirements of one or more of said rules, the second part of each of said rules is executed. 
   
     
     
         2 . The computer-implemented method of  claim 1 , wherein the one or more events are stored to a first table of a first database and the first parts of the rules are stored in a second table of the first database and wherein the first database is operatively coupled to an event handling service, wherein the second part of each of the rules comprises a pointer linking to one or more executable instructions, wherein in case it was determined that the event is non-compliant with the low-level system requirements of one or more of said rules, the pointer of said rule is automatically selected, thereby triggering the execution of said one or more instructions. 
     
     
         3 . The computer-implemented method of  claim 2 ,
 wherein upon storing each of the events to the first database ( 224 ) a time stamp is stored in association with said event;   wherein the received events are collected in the first database during a predefined time period;   wherein the execution of the steps of determining the event type, determining the event metadata, determining the one or more control data objects and determining and executing the one or more rules is triggered after said predefined time period has elapsed, said steps being executed selectively on events having a younger time stamp than a reference moment, the reference moment being calculates as current system time minus the predefined time period.   
     
     
         4 . The computer-implemented method of  claim 1 , wherein determining each of the one or more control data objects comprises:
 determining a first link between the event type and the control data object; and   determining a second link between the control data object and each of the one or more rules,   wherein the first link belongs to a plurality of first links connecting event types and control data objects in accordance with a many-to-many relationship, and   wherein the second link belongs to a plurality of second links connecting control data objects and rules in accordance with a many-to-many relationship, the first and second links being determined dynamically by a control rule assigner module.   
     
     
         5 . The computer-implemented method of  claim 1 , wherein each control data object and each rule is stored in association with a business process and wherein each control data object and each rule is respectively stored in association with an organization unit data object, wherein the method preferentially in addition comprises the step of validating the event data of each of the events to determine if the event data of said event is in a valid format for evaluating. 
     
     
         6 . The computer-implemented method of  claim 2 , further comprising:
 determining if a number of events stored in the first database is above a threshold;   changing a reference value of at least one of the criteria used to evaluate events if the first database is above the threshold to cause a percentage of events determined to be non-compliant to decrease; and   changing the reference value of at least one of the criteria used to evaluate the event if the event data storage is below the threshold to cause the percentage of events determined to be non-compliant to increase.   
     
     
         7 . The computer-implemented method of  claim 1 , wherein executing the second part of at least some of the rules comprises outputting remediation information associated with one of the events if said event is determined to be non-compliant. 
     
     
         8 . The computer-implemented method of  claim 1 , wherein the event is received from an outside system via a network through an event interface. 
     
     
         9 . The computer-implemented method of  claim 1 , wherein executing the second part of at least some of the rules comprises triggering a workflow to perform predetermined actions for remediating the event if the event is determined to be non-compliant. 
     
     
         10 . The computer-implemented method of  claim 9 , wherein executing the workflow comprises communicating, by a notifier module, with the outside system to notify the outside system that the event was non-compliant with the low-level system requirement of said rule if the event is determined to be non-compliant 
     
     
         11 . The computer-implemented method of  claim 2 , wherein each of the rules is assembled dynamically before executing said rule, each of said rules being assembled from a rule template of said rule and from structural data contained in the metadata of the event types of the event to be evaluated, wherein said structural data comprises a mapping of fields of the event type of the event to be evaluated to columns of the first table, wherein said rule template comprises a placeholder for each of the rule's criteria, the placeholders of each rule being connected to each other via one or more operators, and wherein the assembly comprises inserting into each of the placeholders of said rule template one of the data values retrieved from the first table by creating database queries based on the mapping contained the metadata of the event type of the event to be evaluated. 
     
     
         12 . The computer-implemented method of  claim 11 , wherein the pointer and its corresponding second rule part is selected from a group of pairs, each pair comprising a pointer and a second rule part, said group consisting of:
 an URL—a program script or application executed upon selection of said URL;   an URL in combination with a mobile phone number of a user—program routines for sending a SMS message to said mobile phone number, and   an URL in combination with an e-mail address—program routines for sending an e-mail to said e-mail address.   
     
     
         13 . The computer-implemented method of  claim 9 , wherein the executed workflow belongs to a plurality of workflows stored to the first database, each workflow being stored in association with an identifier of at least one of the event types, and wherein triggering the workflow when executing the second part of said rule comprises determining the one or more workflows stored in association with the event type of the evaluated event. 
     
     
         14 . A non-transitory computer-readable storage medium containing instructions for controlling a computer system to perform the steps of  claim 1 . 
     
     
         15 . A computer-system comprising:
 one or more computer processors;   a computer-readable storage medium;   a first database being operatively coupled to the computer-system;   an event handling service comprising an event validation module and a control rule assigner module;   a rules engine;   an event interface;   wherein the event handling service is operable to store a plurality of event types in association with event metadata in the first database, the metadata specifying one or more fields of the event type; to receive one or more events via the network interface; for each of said events, to determine an event type in the plurality of event types for said event; to determine the event metadata for the determined event type; and to determine event data from said event by reading data values stored in the fields of said event specified by the metadata;   wherein the control rule assignment module is operable to determine one or more control data objects stored in association with the determined event type, each of the one or more control data objects representing a high-level system requirement;   wherein the rule engine is operable, for each of the determined control data objects, to determine one or more rules stored in association with the control data object, each rule having the function to evaluate compliance of an event with a low-level system requirement being particular to said rule, each rule comprising a first part and a second part, each first part comprising one or more criteria being evaluated against one of the data values of said event; and to execute each of the determined rules, thereby evaluating each of the one or more criteria of said rule against one of the data values of said event to determine if the event is non-compliant or compliant with the low-level system requirement of said rule, wherein in case the event is compliant with the low-level system requirement of said rule, the event is also compliant with the high-level system requirement of the control data object for which said rule was determined, and wherein in case the event is non-compliant with the low-level system requirement of said rule, the event is also non-compliant with the high-level system requirement of the control data object for which said rule was determined;   in case it was determined that the event is non-compliant with the low-level system requirements of one or more of said rules, the second part of each of said rules is executed.